In the Linux kernel, the following vulnerability has been resolved:
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
In the ssi_protocol_probe() function, &ssi->work is bound with
ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
within the ssip_pn_ops structure is capable of starting the
work.
If we remove the module which will call ssi_protocol_remove()
to make a cleanup, it will free ssi through kfree(ssi),
while the work mentioned above will be used. The sequence
of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| ssip_xmit_work
ssi_protocol_remove |
kfree(ssi); |
| struct hsi_client *cl = ssi->cl;
| // use ssi
Fix it by ensuring that the work is canceled before proceeding
with the cleanup in ssi_protocol_remove().
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2025-04-18 15:15
Updated : 2025-11-03 20:18
NVD link : CVE-2025-37838
Mitre link : CVE-2025-37838
CVE.ORG link : CVE-2025-37838
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free